UK Fraud Hit a Record 4 Million Cases Last Year. Here Is How the Three Most Common Scams Actually Work.

The Numbers

Four million fraud cases were registered in the UK last year, according to UK Finance, the banking trade body. That is a record. UK Finance acknowledges that number understates reality — most fraud goes unreported.

Sam Little, a 35-year-old former contestant on the BBC show The Traitors, revealed last week that he lost £40,000 in life savings to a phishing scam. "I like to think I'm savvy, but it can catch anyone," he told BBC News. He's right. Fraudsters are not counting on victims being stupid. They are counting on victims being busy, distracted, or briefly trusting.

Scam One: The Fake Text

The mechanics are simple. A fraudster sends mass messages, sometimes posing as a family member with a new phone number, sometimes pretending to be a delivery company with a missed parcel. The goal is identical in both cases: get you to click a link or hand over banking details.

Banks reported a surge in so-called "Hi Dad" scam messages in the run-up to Father's Day, according to BBC News. The "Hi Mum" variant has been circulating longer. The message creates urgency: new phone, can't access bank, need money fast. It exploits the instinct to help a family member without stopping to verify.

The fake delivery version takes a different route. The link in the message leads to a convincing copy of an official courier website — Royal Mail, DHL, or whoever the fraudster decides to impersonate. Victims enter card details to pay a small "redelivery fee." Those details are then used in remote-purchase fraud, where criminals buy goods using stolen card numbers.

Remote-purchase fraud cost UK consumers £423 million last year alone, per UK Finance.

The fix is straightforward: do not tap links in texts. Type the URL manually in your browser. If the message is genuinely from Royal Mail, royalmail.com will still be there. If it isn't, you've just avoided handing your card details to a criminal.

One-Time Passcodes (OTPs) deserve special attention. Banks send these codes as a second layer of security, but fraudsters have adapted. A caller will keep a victim on the phone, sometimes for a long time, while pretending to be a bank employee "authorizing" a transaction, then ask the victim to read out the OTP. That code should never be shared with anyone. Not a bank. Not a courier. Not anyone who called you.

Scam Two: The Fake Romance

Romance scams are at a record high, according to BBC News. The average victim sends 10 separate payments to the fraudster before the scheme collapses or is discovered. Some never accept that the person they fell in love with does not exist.

The setup takes time. A fraudster creates a profile on a dating site using photos stolen from real people's social media accounts, builds a relationship over weeks or months, and eventually presents a crisis — an accident, a medical emergency, a plane ticket needed to finally meet in person. The victim, emotionally invested after genuine-feeling conversations, sends money.

The strongest objection to public warnings about romance scams is worth stating plainly: people targeted are not naive fools who ignored obvious red flags. These operations are professionally run. The conversations are emotionally real to the victim. The grooming process is deliberate. Dismissing victims as gullible misses the point and discourages reporting. That concern is legitimate.

The practical countermeasure does not require skepticism about love. It requires a reverse image search. Most major search engines offer this: upload the profile photo and see if it appears elsewhere online under a different name. If it does, the relationship is a fiction. Experts also uniformly advise never sending money to someone you have not met in person.

What the Source Doesn't Cover

BBC News's coverage focuses entirely on the UK. The underlying scam mechanics are not British. The same phishing texts, fake delivery notices, and romance fraud operations run across the US, Canada, and Australia. UK Finance's £423 million remote-purchase fraud figure does not include parallel losses in other markets, which are substantial.

The article also does not address what recourse victims have after the fact. UK banks have faced pressure, and in some cases regulatory requirements, to reimburse authorized push payment fraud victims. That reimbursement framework applies to some of these cases, but not all. Victims of card fraud from phishing links have a different legal standing than victims who willingly transferred money to a romance scammer. That distinction matters enormously if you're trying to get money back.

The Unresolved Question

UK Finance reports four million cases and counting, but the organization's own acknowledgment that fraud is massively underreported means no one has a reliable figure for the actual scale. Whether the record count reflects more fraud, more reporting, or both is genuinely unknown, and that gap matters for any policy response aimed at closing it.